The Act implementing the GDPR - what personal data can be demanded from candidates and existing employees?

From May 4, 2019, employers are required to apply the new regulations governing the processing of personal data of job candidates and existing employees. The changes cover, among other things, the scope of information collected as part of the recruitment processes and processing of biometric data and were introduced mainly in order to bring the existing regulations into compliance with the GDPR.

The Act of February 21, 2019 on the amendment of certain Acts in connection with the introduction of Regulation 2016/679 of the European Parliament and Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46 / EC, otherwise known as the GDPR Implementing Act, introduces changes to as many as 160 legal acts. In addition to issues related to the acquisition of personal data by an employer for the purposes of the recruitment process and thereafter, the amended provisions also apply to such areas as the use of workplace monitoring and the processing of sensitive data.

The recruitment process - what personal data can be obtained from the employment candidate?

According to the amended art. 22 (1) sec. 1 of the Labour Code, the employer may request from an employment candidate, the following information:

• first name (names) and surname,
• date of birth,
• candidate's contact data
• education details,
• professional qualifications,
• employment history.

Until now, the aforementioned provision allowed for the collection of a variety of other personal data on the candidate, including, inter alia: place of residence (correspondence address) or names of parents. Due to the fact that such data are not necessary for the purposes of the recruitment process, they were deleted from the Labour Code. This does not mean, of course, that the candidate can not now voluntarily place this information in his/her CV - however, the fact that the employer can not demand it from them should be noted. As far as concerns the data on the candidate's education, his/her professional qualifications and employment history - here the employer may request such information only if it is actually necessary to perform the work in question.

Processing data of existing employees

The Implementing Act also introduces significant changes related to the processing of personal data of existing employees. These mainly concern biometric data and the use of monitoring at work. Following the entry into force of art 22 (1) sec.1 of the Labour Code, the employer may process the following personal data of employees:

• first name (names) and surname,
• date of birth,
• employee's contact data
• education details,
• professional qualifications,
• employment history.

The type of data is therefore the same as in the case of candidates, but in addition - according to the amendment to art. 22 (1) sec. 3 of the Labour Code - the employer may request additional personal data from existing employee, such as:

• place of residence,
• PESEL number or type and number of other identification document,
• other personal data of the employee, as well as personal data of his/her children and other closest family members - this applies to situations in which the employee utilizes the special rights provided for in the Labour Code and providing the above data is necessary for this reason,
• data relating to the employee's education and history of previous employment, if there was no basis for requesting such information in the recruitment process,
• payment account number - if the employee has not applied for the payment of remuneration in cash.

The employer, being the administrator of employee personal data, is obliged to provide employees with detailed rules governing the processing of such data. In article 13 of the GDPR, there are precise indications as to what information should be included in the wording of such rules.